CVE-2024-1488

Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Unbound Codeready Linux Builder Codeready Linux Builder Eus and 21 more

CVE-2023-5869

Postgresql: buffer overrun from integer overflow in array modification

A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.

CVSS 3.1 · 8.8 High EPSS 4.3% KEV · Not listed

Vendors

Postgresql Redhat

Products

Postgresql Advanced Cluster Security Codeready Linux Builder Eus and 25 more

CVE-2023-5633

Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Codeready Linux Builder Codeready Linux Builder Eus and 21 more

CVE-2021-31566

libarchive: symbolic links incorrectly followed when changing modes, times, ACL and flags of a file while extracting an archive

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Libarchive and 2 more

Products

Debian Linux Fedora Libarchive and 11 more

CVE-2026-39979

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jqlang Redhat

Products

Jq Ai Inference Server Ansible Automation Platform and 11 more

CVE-2021-3737

python: urllib: HTTP client possible infinite loop on a 100 Continue response

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 13.2% KEV · Not listed

Vendors

Canonical Fedoraproject Netapp and 3 more

Products

Ubuntu Linux Fedora Hci and 15 more

CVE-2021-3733

python: urllib: Regular expression DoS in AbstractBasicAuthHandler

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

CVSS 3.1 · 6.5 Medium EPSS 4.8% KEV · Not listed

Vendors

Fedoraproject Netapp Python and 1 more

Products

Extra Packages For Enterprise Linux Fedora Hci Compute Node Firmware and 18 more

CVE-2022-1011

kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 3 more

Products

Debian Linux Fedora Linux Kernel and 36 more

CVE-2022-0492

kernel: cgroups v1 release_agent feature may allow privilege escalation

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

CVSS 3.1 · 7.8 High EPSS 5.5% KEV · Listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 36 more

CVE-2019-11135

hw: TSX Transaction Asynchronous Abort (TAA)

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.

CVSS 3.1 · 6.5 Medium EPSS 3.1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 6 more

Products

Ubuntu Linux Debian Linux Fedora and 309 more

CVE-2019-8720

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Listed

Vendors

Redhat Webkitgtk Wpewebkit

Products

Codeready Linux Builder Codeready Linux Builder Eus Codeready Linux Builder For Arm64 Eus and 20 more

CVE-2022-0847

kernel: improper initialization of the "flags" member of the new pipe_buffer

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS 92.8% KEV · Listed

Vendors

Fedoraproject Linux Netapp and 4 more

Products

Fedora Linux Kernel H300e and 39 more

CVE-2021-3669

kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts

A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Ibm and 2 more

Products

Debian Linux Fedora Spectrum Copy Data Management and 21 more

CVE-2023-4641

Shadow-utils: possible password leak during passwd(1) change

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Shadow-maint

Products

Codeready Linux Builder Codeready Linux Builder For Arm64 Codeready Linux Builder For Ibm Z Systems and 7 more

CVE-2021-44142

samba: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution

The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.

CVSS 3.1 · 8.8 High EPSS 73.6% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 25 more

CVE-2025-1756

MongoDB Shell may be susceptible to local privilege escalation in Windows

mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mongodb Redhat

Products

Mongosh Codeready Linux Builder Eus Codeready Linux Builder For Arm64 Eus and 10 more

CVE-2023-0179

kernel: Netfilter integer overflow vulnerability in nft_payload_copy_vlan

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS 1.9% KEV · Not listed

Vendors

Canonical Fedoraproject Linux and 1 more

Products

Ubuntu Linux Fedora Linux Kernel and 12 more

CVE-2022-0516

kernel: missing check in ioctl allows kernel memory read/write

A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 2 more

Products

Debian Linux Fedora Linux Kernel and 29 more

CVE-2022-0435

kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS

A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.

CVSS 3.1 · 8.8 High EPSS 67.8% KEV · Not listed

Vendors

Fedoraproject Linux Netapp and 2 more

Products

Fedora Linux Kernel H300e and 37 more

CVE-2022-0330

kernel: possible privileges escalation due to missing TLB flush

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Netapp and 1 more

Products

Fedora Linux Kernel H300e and 49 more